Building a Transparent Firewall with Linux, Part V

As you may be aware, Ubuntu has adopted a new startup script system. The
old one, the init system, still works, and if you prefer, you can enable
the script in Listing 2 the old-school way by making it executable
and creating rc.d links by running this command:

However, I recommend you take the plunge into the world of the newer
“upstart” system by skipping update-rc.d and instead adding the following
script, iptables_custom.conf (Listing 3), to /etc/init
(not
/etc/init.d).

Rather than requiring you to figure out which start/stop number to
assign to your “rc.” links, upstart lets you just specify what needs to
start beforehand (in this example: network-interface, network-manager
or networking). As you can see, this iptables_custom.conf file
then invokes /etc/init.d/iptables_custom, as listed in Listing 2,
to do the actual work of loading or unloading rules. For that reason,
/etc/init.d/iptables_custom must be executable whether you use it as an
init script or an upstart job.

After saving your /etc/init/iptables_custom.conf file, you must enable
it with this command:

bash-$ sudo initctl reload-configuration

Now you either can reboot or enter this command to load the firewall
rules:

bash-$ sudo initctl start iptables_custom

Conclusion

And that, in one easy procedure, is how to create a bridging firewall
using a Linux PC! I hope I've explained all of this clearly enough for
you to figure out how to make it meet your specific needs. I also hope
you found the previous few months' foray into OpenWrt to be worthwhile.

The Paranoid Penguin will return in a couple months, after I've had
a short break. In the meantime, go forth and secure things!

See also my book: Bauer, Michael D. Linux Server
Security, second edition. Sebastopol,
California: O'Reilly Media, 2005.
Chapter 3 explains iptables in detail, and Appendix A
contains two complete iptables scripts. Although focused on
“local”
(“personal”) firewalls rather than Internet or LAN firewalls, this
material nonetheless should be helpful to iptables
beginners.

Mick Bauer (darth.elmo@wiremonkeys.org) is Network
Security
Architect for one of the US's largest banks. He is the author of
the O'Reilly book Linux Server Security, 2nd edition
(formerly called
Building Secure Servers With Linux), an occasional
presenter at
information security conferences and composer of the “Network
Engineering Polka”.